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ourse Welcom 
Ea “Welcome” Slide 1 

Lesson 1 —Introduction to the 

‘Business Records (BR) FISA 

Lesson 2 -Reasonable Articulable 

Suspicion (RAS) 

Lesson 3 — First Amendment 

Considerations 


Lesson 4 — The BR FISC Order 
Lesson 5 — Accessing, Sharing, 
Dissemination, and Retention 


(U//FOUS) Welcome to the Business 
Records (BR) FISA web-based 
training (WBT). 


(TOU UTN 


CFSHSIHNE- This course provides 


{@) training for analysts who will be 


authorized to query the raw metadata 
collected by the BR FISA. 


(U//FE6U6) The course is comprised of 
five Lessons. 


STOMA 


+FSHSHNE The lessons contained in 


the BR FISA course are: 
Lesson 1 -Introduction to the 
Business Records (BR) FISA 
Lesson 2 -Reasonable 
Articulable Suspicion (RAS) 
Lesson 3 — First Amendment 
Considerations 
Lesson 4 — The BR FISC Order 
Lesson 5 —Accessing, Sharing, 
Dissemination, and Retention 


Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On: 20341667 


(U//FGUC} The course begins with an 
overview of the BR FISA authority and 
then moves into an overview of the 
Reasonable Articulable Suspicion 
standard. Next, students will explore 
First Amendment considerations 
before taking a closer look at the BR 
FISC Order. The BR Order points out 
special considerations that distinguish 
this FISA authority from other FISAs 
typically encountered at this Agency. 
The final lesson of this course 


provides specific rules and procedures 
regarding the access, sharing, 
dissemination, and retention of BR 
FISA metadata. 


Lesson "Welcome", Slide 3-Course Objectives 


Sa) 


eldentify terms and processes associated with the 
Business Records FISA 

eldentify common sources of information used for 
determining RAS 

eState limitations for targeting US persons under the 
RAS standard 


=o 


a 


«identify access, sharing, dissemination, and retention t 


procedures under the BR FISA Order 


At the conclusion of this course you 
should be able to: 


eIdentify terms and processes 
associated with the Business Records 
FISA Order 

eIdentify common sources of 
information used for determining RAS 
e State limitations for targeting US 
persons under the RAS standard 


| eldentify access, sharing, 


dissemination, and retention 
procedures under the BR FISA Court 
Order 


: jucinoee Pregagaabl > Business Records (BR) FISA - 
ee ee ==Course Welconie- = 


ne 


ough 
the different course lessons you may 
want to also access the related Legal 
Readings. The two core readings are 
the Reasonable Articulable Suspicion 
(RAS) memorandum written by OGC 
and the BR FISC Order issued by the 
FISA Court. 


(U/AF6UC} You can access these 
documents by clicking on the Legal 
Readings button located in eCampus. 


r sii 


Lesson 1 Slide 1 Introduction and Definitions 


P. 2 i eae Falls Records e 
BR FISA = Specific authority given by B Foreign intoligence Surveilance Ast Court 
Ise une allows NSA to obtain metadata 


the FISA Court (FISC) that allows NSA | fom the business records of certain 
to obtain metadata from the business | 


Pol -s#SWNE}-This data consists of telephony 
metadata obtained from business records 


records of certain specified I provided under a court order by US 
telecommunication companies. a 


il. 


This FISA is authorized because 
the FISC recognizes there is a 
counterterrorism-interest in obtaining those 
business records. However, because 
there is a great deal of US person 
communications within those business 
records, the FISC and NSA have instituted 
strict guidelines on the collection, 
processing, retention, and dissemination of 
the metadata. 


HN You can access the most 
current BR Order from the links on the 
Legal Readings button in this course 


Mouse Over: [1] (TS//SI//NF) =z 
ions 


refers to electronic communica 
service providers located inside of the 
United States who afgeplipeeter toss) h 


o the Business: 


Lesson 1 Slide 2 Introduction to the BR.-Objectives 


4TSYSHINE\ This lesson will enable 


you to: 


Lesson 1 — Introduction to the BR [| -Identify the purpose of the BR FISA 


*Recognize the 


Objectives: ; | eg covered by the BR FISA Court a, 
4, Order 


Define terms relevant to the BR FISA 
Order: telephony metadata, telephony 


° Identify the purpose of the BR se 
FISA Fi 
eRecognize the EES 
groups covered by the 
BR FISA Order 
eDefine terms relevant to the BR 
FISA Order: telephony metadata, 
telephony identifier, hops, and 


-ESSOn i- Introdt 
= Records (BR) 


Lesson 1 Slide 3 Overview of RAS. 


A IER fs 


a = (U/A-6U6} Before we begin, you will need 
Overview oT RAS Rt to understand some key terms. To 
access a vocabulary list please use the i 
legal readings link on the right side of the 
page and open the BR Glossary. Let’s 


š F i P f f th ll i i 
The term associated is defined in the RAS Memo to {| coursenow. UNIS 
V2) -<FSHSHASS The term associated is 


mean, “engaged in a common enterprise” with: J defined to mean “engaged in a common 
| Ht 


i >S f| listed in the Order or 10 


The BR FISA Order list specific 
groups that are vrnawn to be 


= ees SS These 
are groups designated by the 
National Counter Terrorism Center 
{NC LC) to have ailied them selves 
wiih p ae i. 


e One of the groups designated by the National it 
i ee TET \o other groups other than those 
Counter Terrorism Center (NCTC) to have allied listed in the BR FISC Order can be 


used to justify access under the BR 

itself with | ES anion. Thig list can be ; 
f obtained from a Homeland Mission 

; Coordinator (HMC). Because the 


e Someone acting as their agent. | r eer yeay enay 


every 60-90 days, the list of terrorist 
groups is subject to change. 


e No other groups other than those listed inthe BR |} arn tre NOt tet eo 
FISC Order can be used to justify access under J| igengfięs known aliases for groups listed in | 
the BR FISA authority. 


Lesson 1 - Introduction to the Business 


= Records (BR) F i {TS#SiNPHere’s the definition of 
a ; ake: telephony metadata which you will 
y i need throughout this course. 


(TSS The Telephony Metadata 
obtained from the BR FISA is 
comprehensive communications 
routing information. Specifically it may 

contain: 
“Telephony Metadata and Telephony Identifers” > Originating and terminating 
Telephony metadata telephone numbers 
Metadata collected — includes comprehensive communications routing International Mobile Subscriber 
information Identity (IMSI) numbers 


Originating and terminating telephone numbers Mobile Sgbacribar Inegraisd 

i : : Services Digital Network 
international Mobile Subscriber Identity (IMSI) numbers ; (MSISDN) numbers 
Mobile Subscriber Integrated Services Digital Network (MSISDN) i International Mobile station 
numbers Jel Equipment Identity (IMEI) 
International Mobile station Equipment Identity (IMEI) numbers i numbers 
Trunk identifiers Trunk identifiers 
Telephone calling card numbers a Telephone calling card numbers 


Time and duration of calls bat Time and duration of calls 


bet Telephony metadata does NOT include {| 4FSHSWNE}- The BR FISA authority 
i Tadi e° Substantive content of any communication _ does not extend to the content of these 


communications. The BR FISA does 
NOT include substantive content of 
customer any communication, or the name, 
address, or financial information about 

Telephony identifiers correlate to Business Records metadata collected by a subscriber or customer. 

the providers, such as MSISDN or a calling card number. Telephony E: 

identifiers are also known as: identifiers. | F 4SHSHRED Ta idanij 
’ | — also known as 
Redes aa i J i iiics. 


o Name, address, or financial information about a subscriber or 


| Piauiced eo aR _© Lesson 1 - Introduction to the Business 


pues 


HN} A telephony identifier 
i (selector), is called a Seed when it is 
RAS- ‘et being used to search the BR 
approved repository. When querying the BR 
metadata repository, Business 
N Records FISA (BRF)-approved 
fg {2} individuals, also known as BRF 
pme j ‘et chainers, conduct contact chainin 
| : First HOP | i NEE c ics in 
i í Wt order to obtain the contacts between a 
4 i seed and other telephone identifiers 
Raleetine Jè} (numbers in contact with the RAS- 
One Jef approved-Seed). 


tt Order, a query always begins with a 
Second HOP ‘| RAS-approved-Seed. In this case the 


RAS-approved-telephone identifier is 
called a ‘Seed’ because it is being 
used for chaining and analysis to 
create a ‘tree’ of contacts and identify 
new potential terrorist associations. 


FISC authorizes third hop chaining, 


CT Policy limits chaining through 2 hops J Quantity of i +TSHSHINF) The BR FISC Order 
contacts 7 authorizes “3-hop chaining”; however 
only it is CT’sl_1] recommended practice to 

a ae restrict chaining to two hops. This 
means that telephony identifiers up to 
two hops away from the Seed may be 
chained. Chaining reveals the 
contacts of the identifier. 


x 


‘Lasson 1 Slide 6 “Associations to establis 


seve “ - =r: 


Associations to establish a RAS nomination 


Associations to establish a RAS nomination 


Reasonable Articulable Suspicion (RAS) standard - requires that an NSA analyst 
must be able to point to a single fact that points to the fact that a selector may be 
associated with a terrorist group listed in the FISC Order before we are 
authorized to conduct analysis on it. 


RAS determination - should cause a reasonable person to suspect that the 
identifier is associated with one of the terrorist organizations named in the Order. 


Recall that the BR FISC 
Order allows NSA to obtain an 
immense amount of foreign and US 
metadata contained in the Business 
Records. The FISC Order contains 
strict guidelines on when this metadata | 
is allowed to be accessed and when it 
is not. It must be associated with 
specific terrorist organizations named 
in the Order. It also must meet a 
standard that is referred to as the 
Reasonable Articulable Suspicion 
(RAS) Standard. In a nutshell, the 
RAS standard requires that an NSA 
analyst must be able to point to a 
single fact that points to the fact that a 
seed/telephone selector may be 
associated with a terrorist group listed 
in the FISC Order before we are 
authorized to conduct analysis on it. 


—FSHSHINE} We will address the RAS 


standard in detail in the next lesson, 
but for now, understand that the factor ; 
facts which make up a RAS 
determination should cause a 
reasonable person to suspect that the 
identifier is associated with one of the 
terrorist organizations named in the 
Order. 


Legal Disclaimer 


This courss: 
IS NOT designed to take the place of: IS designed to enhance understanding of: 


Homeland Mission Coordinator (HMC} BR FISC Order 
Office of Oversight & Compliance {SV} RAS standards 


Office of General Counsel (OGC) 


Renewed approximately every 60-90 days 
Contact your local HMC, SV, or OGC for case-specific guidance. 


(U//FG6U6) This course is not 
designed to take the place of specific 
guidance from a Homeland Mission 
Coordinator (HMC), the Office of 
Oversight & Compliance (SV), or from 
the Office of General Counsel (OGC). 
The course is designed to enhance 
your understanding of how to comply 
with the BR FISC Order and to 
understand the RAS standards used in | 
concert with BR FISA. 


(U//FO¥S} Because, the BR FISC 
Order is renewed approximately every 
60-90 days, the FISC may change the 
authority or place new restrictions in a 
new FISC Order. It is important to 
understand that unique operational 
circumstances may result in a change 
in guidance from this course. 
Therefore, if you experience any 
uncertainty (delete) it is always sound 
advice to contact your local HMC, SV, 
or OGC for case-specific guidance. 


tTSHSHINFS You have now completed 


i Hae the lesson that discusses the BR 
i ; | FISA authority. 


Summary 1 {FS#SHNF} You should now be able 
f to: 


You should now be able to + Identify the purpose of the BR 
FISA Order 


e Identify the purpose of the BR FISA | l Recognize the = | 
Fe MQ groups covered by the 
Order BR FISA Order 


: = Define terms relevant to the BR 
Recognize the | PISA Order: telephony 
metadata, telephony identifier, 


Ae covered by the BR FISA haps, and Esad 
rder 


Define terms relevant to the BR FISA 
Order: telephony metadata, telephony 
identifier, hops, and Seed 


Reasonable Articulable Suspicion (RAS) 


-FSHSIHNE}This lesson provides an overview 
of the Reasonable Articulable Suspicion 
(RAS) Standard. RAS guidance is outlined 
in an OGC memo. It provides definitions 
and descriptions that will help you 
understang ist 3 o 


to 
identifiers under the BR Court Order. 


{FSH#SIHNF}Recall that the BR FISA Order lists 
those specific terrorist pa that are 
associated with either 


BR FISA course lessons: F TEENE 


current BR Order from the links on the Legal 


Lesson 2 — Summary of the Standard Readings button in this course. 


—+FSHSHANEThe BR FISA Order also states 
that in order to access the BR FISA 


P A tadata, NSA t establish RAS h 
Define the Reasonable Articulable Standard (RAS) used to selector that twishes to query within the 
justi Coordinator (or named individual in the 
justify a BR FISA metadata search 

Order) may make a RAS determination and 


" . . =a" . . . . j 3 h h . l t fi A j 

Identify prohibitions against instinct and hunches in contrast 7 e a ER E 
to facts E ae o querying the BR FRA metadata, 
«identify common sources of information used for justifying a f — RAStcquestecutining why £ selecior 9 
RAS should be RAS approved. 


ol j j j j E ESHSHINF} This lesson will enable you to: 
List the common sources of information on which analysis =} oe eee 


rely in making RAS determinations Standard (RAS) used to justify a BR 


FISA metadata search 


Identify prohibitions against instinct 
and hunches in contrast to facts 
List the common sources of 
information on which analysts rely in 
making RAS determinations 

List the ten most typical sources of 
information on which analysts rely in 
making assessments of Reasonable 
Articulable Suspicion (RAS) 


Derived From: NSA/CSSM 1-52 
Dated: 20070108 
eclassify On 


8 


| FSHSHMFY You will recall from Lesson 
Le l One that the BR FISA Order is authorized 
Summary of RAS Standard JEJ because the FISC recognizes there is a 
r { counterterrorism interest in obtaining those 
I ; i business records. However, because NSA 
BR FISC Order { is receiving a great deal of US person 


7 ' er ? i “th sb telephony records, we have strict 
Government may request to use specific identifiers to i » Faf guidelines on when NSA can access the 


j , a af nhtaini . metadata under this authority. One of the 
query the metadata for purposes of obtaining foreign requirements is that in order to access the 


inteligence through contact chaining or|| p | metadata, NSA must establish RAS on 
—————— | each selector prior to querying the BR 
* telephone numbers ee f FISA repositories. 


X —(FSHSINFY The BR FISC Order states 
ba that NSA may quepespecific identifiers 


A T ' Cae. a1 i that satisfy the RAS standard for 
“Reasonabie Articulable Suspicion standard" E Pare ot obtaining counterterrorism 


intelligence. 


| -CFSHSIYNF}-In order to assist in 
determining when a selector has satisfied 
the RAS standard, the Office of General 
Counsel (OGC) has issued a RAS Memo 
to help Signals Intelligence Directorate 
(SID) personnel make RAS determinations 
on telephone identifiers. The memo 
contains guidelines that apply to both the 
BR and Pen Register and Trap and Trace 
(PR/TT) FISA Orders. 


iculable Suspicion (RAS) 


-FSHSHANFS In order to query the BR FISA 
metadata, BRF authorized individuals may only 
query selectors that have been RAS approved 
by a Homeland Mission Coordinator (HMC) (or 
other named officials in the FISA Order). A 
HMC determines, based on the factual and 
practical considerations of everyday life, 
reasonable and prudent persons act, whether 
or not there is a reasonable articulable 


j suspicion that ths selector is associated with z 
RAS Standard Definition PE EE 


There must be at least one qualifying fact giving 
rise to a reasonable articulable suspicion that 
the identifier is associated with one of the 


RAS standard requirements Es j k f terrorist groups listed in the BR FISA Order.[.3] 


; ae ' rea ba ~FSH#SH/NF) The RAS must be approved 
a factis} that cause suspicion the number is associated « SE {| BEFORE you can [.4] use an identifier to query 
with : pe TASE Med | the BR metadata. Analysts are not allowed to 
3 2 cate et f use a hunch or a guess to nominate selectors 
for RAS. RAS nominations or requests 
nominations must specify facts that would 
» i + cause a reasonable person to form that 


‘must be approved by the a Homeland Mission Coordinator or other named offical in the sean 


FISC Order before you use a telephone number identifier to query the database of records (U/FOUC} The RAS standard is far less than 
‘| proof by “probable cause” or “a preponderance 
‘no hunches or guesses to justify targeting of evidence” — it merely requires one fact that 
: can be articulated which would cause a 
4 For | reasonable person to form a suspicion. 


i 
J 


1. 
2 


fe 
$. 


K 


A published NSA report 


Unpublished SIGINT collection 


] 
| l 


Content an alysis | 
SIGDEV work 


Any content analysis where a targeted person 


Direct communication 
NSA target knowledge databases 


Pg 


asonable Articulable Suspicio n (RAS) 


—-CFSHSHANES Searching the Business Records 
metadata is targeting, not analysis. 

- Therefore to make a RAS determination, 
other information sources must be used 
for research and analysis. Remember 
that the RAS standard is merely a reason 
for suspicion through one or more stated 
facts, so the standard is not as high as 
most FISC content surveillance 
authorities. 


F -CSHSIYNE) Information used as a basis to 
satisfy the standard often comes from one 
of the following in-house resources!.21 : 

1. A published NSA report 

2. Unpublished SIGINT collection where 
new accounts have been revealed (and 
can be documented) 


| 

Content analysis that references new 

identifiers in phone fi 

| collection 

SIGDEV work tied to published 

information or part of a target 

development effort 

Any content analvsis where a targeted 
Ld = ay 

person 

Direct electronic communication with a 

identifier that is already known to be 

associated with the Foreign Powers 

through prior BR / PRTT or other 

SIGINT resources 


Information from NSA target knowledae 


Information obtained from [i 


belonging to one of the Foreign Powers 


Lesson 2 Slide 5 “Sources of information” (Encl. 3) 


| —CFSHSIANF) The RAS memo also lists other 
sources of information available for researching 
a RAS. These include but are not limited to: 
Published reports such as: 


SIGINT reports Et. SIGINT reports 


eee ; s Investigations by the CIA or FBI 
| i fy 
Investigations by the CIA or FBI FISA surveillance data derived from other 


| 7 X AE P = { i authorized targets 
n aye i FISA surveillance data derived from other eal SIGDEV work tied to published information 


authorized targets 3 Other transcripts 
Eat AFSHSHNF} Looking at the IC and public sector 
SIGDEYV work tied to published information fg (pen source) |.2] sources we use, these 
Bet include: 
Other transcripts | + ‘The Federal Bureau of Investigation 
1a | e The Central Intelligence Agency 
iia. Published reports at The National oo Center 


Se Full feld investigations Et Public records available on the internet, 
3 i : news papers or other public resources/.3] 


Preliminary investigations 


| FISA surveillance 
| SIGDEV work tied to published infor 


Transcripts 


PEEL SRN PT E E OA I PINSE EAN Fe 1a Ne N ME E a a fa 


(U//FEBU8) You have completed the lesson 
summarizing the RAS standard 


SUMMARY i | -CFSHSHANF) You should now be able to: 


. $ i Define the Reasonable Articulable 
You should now be able to: - Pa Standard (RAS) used to justify a BR 


FISA metadata search 


. f Te Identify prohibitions against instinct 
eDefine the Reasonable Articulable Standard (RAS) used to pt and hunches in contrast to facts 
justify a BR FISA metadata search fe gonty ee 


f KREA ; $ z ; information used for justifying a RAS 
eldentify prohibitions against instinct and hunches in contrast to liist the common sources of 


facts information on which analysts rely in 
eIdentify common sources of information used for justifying a : eee ak eae 

RAS 

eList the common sources of information on which analysts 

rely in making RAS determinations 


Lesson 3: First Amendment Considerations 


Lesson 3 Siida 1 “Lesson Objectives” » 


—CFSHSHANP This lesson is a 


continuation on the Reasonable 
Articulable Suspicion (RAS) standard 
guidelines. 


T] -FSHSIYNE) RAS determinations are 
; j : {>| approved by a HMC (or an official 
Lesson 3 — First Amendment Considerations | named in the Order) BEFORE queries 
can be made using a particular 


List some basic protections of US persons selector within the BR metadata. 


Another restriction associated with 


provided by the First Amendment of the US RAS is the prohibition of making a 


Tet F4 RAS determination based solely on 
Constitution. Ja] activities protected by the First 


Amendment. 


EFSHSHANP) At the conclusion of this 


lesson, you should be able to: 


Describe the prohibition against using First alla gies eae nfotectione for US 


«eye persons provided by the First 
Amendment protected activities as the sole Amendment he US 


justification for a RAS involving a US person. Constitution. 


Describe the prohibition against 
using First Amendment protected 
activities as the sole justification 
for RAS involving a US person (as 
defined in USSID SPO018). 


rare 
namen. 


(U/FOUSC) The First Amendment of 
the US Constitution prohibits Congress 
from making any laws that would 
infringe on the free exercise of: 


Religion 

Speech 

The press 
Peaceable assembly 


To petition the government for 
redress of grievances 


(TSYSW/NE) Remember the RAS 
Memo clarifies the FISC’s prohibition 
of a RAS determination based solely 
on activities that are protected by the 
First Amendment. This applies when 
targeting a US person as defined in 
USSID SP0018 or a person 
reasonably believed to be located 
inside the United States. 


SUMMARY 
You should now be able to: 


List five basic protections for US persons 


provided by the First Amendment of the US 
Constitution 


eDescribe the prohibition against using First 
Amendment protected activities as the sole 
source of justification for a selector involving a 
US person. 


—-CFSHSHANS You should now be able 
to: 

e List five basic protections for US 
persons provided by the First 
Amendment of the US 
Constitution. 

Describe the prohibition against 
using First Amendment protected 
activities as the sole source of 
justification for an identifier. 


Lesson 4 Slide.1 “Lesson Objectives” 


in this lesson we will examine a Business Records 
(BR) FISA Court (FISC) Order. 


At the conclusion of this lesson you will be able to: 


* identify BR FISC Orders as NSA’s authorization to 
collect telephony metadata from specified US 
telecommunication companies in order to protect 
against international terrorism 


-FSHSH/NE) In this lesson we will 


examine a Business Records (BR) 
FISA Court (FISC) Order. At the 
conclusion of this lesson you will be 
able to: 


eldentify BR FISC Orders as NSA’s 
authorization to collect telephony 
metadata from specified US 


to protect against international 


terrorism 


60 - 90 days 


| "What are BR Orders?" 


The authority is for collection of tangible things 
gathered by the FBI to protect the US against 
intemational terrorism. 


«The RAS standard requires an ability to 
articulate an association with Ii 
terrorist 
groups listed within the order. 


- Lesson 4: ‘The BR Order 


= (FSHSHNA BR Ordérs allow NSA to obtain Eikon 
metadata from US telecommunication companies, 
compelled to do so under a court order. This FISA 
Order requires specified telecommunication providers 
to share business records in the form of telephony 
metadata with the US government. 


+FSHSIHNE The BR FISA authority is for collection of 
tangible things gathered to protect the United States 
against international terrorism. BR Orders are 
renewed approximately every 60-90 days. We will refer 
to the valid order as the FISA BR Order. 


4FSHSIYNE) Since this authority is concerned only with 
metadata and no content of those communications, 
NSA has a lower burden of proof for targeting an 
identifier when compared to other FISA authorities. 


—FSHSIHNFS All that is required is that a selector meet 
the Reasonable Articulable Suspicion (RAS) standard 
that a selector is associated with a terrorist group 
listed in the BR FISA Order. All of the listed terrorist 
iJroups are associated with | 


-FSHSHNFY All identifiers are approved by an HMC (or 
official named in the Order) prior to querying the 
authorized repositories. 


-~TFSYSH/NE\ NSA can use identifiers, after they have 
been approved for RAS, to query the BR metadata for 
counterterrorism threats to the homeland. The BR 
Court Order only authorizes contact chaining and 
jueries within the metadata. 


“Tangible Things as oniy Telephony metadata” 


“tangible things” 
“an electronic copy of telephony metadata (call records)“ 


» Comprehensive communications routing information including: 
« Origination and terminating telephone number 
¢ Intamational Mobile subscriber identity (MSI} number 
¢ Intemational Mobile station Equipment identity (MEI number 
» The trunk identiier 
¢ Telephone calling card numbers 
e Time and duration of call 


The telephony metadata does not include the substantive content of any communication or the name, 
address, or financial information of a subscriber or customer within these. 


—FSHSHANF} The BR Order clarifies 


“tangible things” to mean an electronic 
copy of telephony metadata (call 
records). This includes: 
e Comprehensive communications 
routing information including: 
e Originating and terminating 
telephone number 
e International Mobile 
Subscriber Identity (IMSI) 
number 
e International Mobile station 
Equipment Identity (IMEI) 
number 
e The trunk identifier 
e Telephone calling card numbers 
e Time and duration of call 


t FSHSHANF} The BR FISA Order 
specifically states that the telephony 


metadata does not include the 
substantive content of any 
communication or the name, address, 
or financial information of a subscriber 
or customer within these. The FISA 
Order deliberately restricts access to 
only communications metadata. 


: -FSHSIHNE}-The metadata obtained from 
the BR FISA authority is used to establish 
connections with terrorist organizations by 
using contact chaining and | | 
l WW jueries. These queries look at 

RAS (Reasonable Articulable Suspicion) {j the contacts of known terrorists to help 
kf NSA establish new connections and 
affiliations with terrorist groups listed in the 


« Justifies the search of metadaia | | court order (i.e. the Foreign Powers). 


» a statement of fact that supports a reasonable E ee Bettie searching the BR 


aes $ pong å ; s} metadata repository, NSA must establish 
suspicion that the identifier is affiliatec with et RAS a a ral i me oe a 
; a : - search within the metadata. isa 

one of the terrerist groups listed in the BR semènt ot tack that suppor 

FISA Order. “1 reasonable suspicion that the identifier is 
affiliated with one of the terrorist groups 
listed in the BR FISA Order. Only 
Homeland Mission Coordinators and 
others named in the BR FISA Order can 
make a RAS determination. 


+FSHSHANE) Remember, the RAS cannot 
be solely based on activities which are 
protected by the First Amendment of the 
US Constitution. 

) -FS#ASHN= To see samples of RAS 

| statements please open the, ‘RAS 
statements’ Job Aid located in the legal 
readings for this course 


Noe 


Lesson 4.Slide $ “Summary” 


—FSHSHANED You should now be able 


to: 


—FSHSHINF) You should now be able to: 


e Identify BR FISC orders as NSA’s 
authorization to collect telephony 


e Identify BR FISC orders as NSA’s authorization to collect I als from oe US 
aes . : BPs | elecommunication companies in 
telephony metadata from specified US telecommunication =} order to protect against 
companies in order to protect against international meg a 


terrorism 


Lesson Objectives | za t _-€ESHSHINF} In this lesson we wil 


continue to examine the Business 
Records (BR) FISA Court (FISC) 


In this lesson we will continue to examine the Business Records (BR) ; BaT eee of this lesson | 
| FISA Court (FISC) Order. At the conclusion of this lesson you will be aa a 
| able to: 


e Distinguish between analysts 
j authorized to query BR FISA 

e Distinguish between analysts authorized to query BR FISA ee ee ad 
metadata and individuals authorized to receive results of those “| those queries 


queries 
Identify further limitations on 


e Identify further limitations on accessing, sharing, disseminating, EI 2nd retaining BR FISA metadata. 


and retaining BR FISA metadata 


$: 


—-CFSHSIHNFE> The Director of NSA 
(DIRNSA) strictly controls access to 
and use of raw BR metadata. 


| (FSHSIYNF- Query access to BR raw 


metadata is limited to individuals 
trained and designated as BR FISA 
Query Analysts. This is the only group 
permitted to query raw BR FISA 
metadata for contact chaining and 
The BR FISA Query Analyst a | Mowposes The BR 
‘The Director of NSA (DIRNSA) strictly controls access lo and use of raw BR metadala. S FISA Order limits the number of 


The Director of NSA (DIRNSA) ae | individuals who can be named in this 
F k ia category as well as how many can be 
strictly controls access to and use of m 4 i E designated as Homeland Mission 
raw BR metadata. A: - F Coordinators. There are several other 
#31 categories of people who are 


authorized to access the raw metadata 
suchas technical individuals and Data 
Sas RAGE Integrity BR FISA Analysts; those who 
Query access fa BR raw metadata is limited lo individuals trained and designated as BR access the repository for the purpose 
Query access to BR raw metadata Fina [| of ensuring that the data is compliant. 


is limited to individuals trained and ere ee: 

à : s -~FSHSHANF) e me ata IS 
designated as BR FISA Query ZEA |} authorized to be stored in two NSA 
Analysts. | i ! repositories 


BR 
: ; Authorized Query Analysts are 
The BR metadata is authorized to be | «tear anayse | permitted to query BR raw metadata, 


The BR metadata is authorized to he slored in wo NSA renositcries- i within | 


stored in two NSA repositories— i bi ito receive query results. 


we'll reiterate it with more detail. 


Oversight for Access Restrictions Me a eee RY DDR! Se 


A n ; S#SHN Signals Intelligence 
Q t Rest ; F . : 
versight for Access Restate Directorate’s Office of Oversight and 


Compliance has implemented a series | 
of auditing controls designed to limit 
access to the BR FISA metadata only 

to those who have been briefed by the 
OGC and those who have completed 

all of the required training. 


{T3731 When the raw metadata is 
accessed in order to perform a query, 
an automatic audit log is recorded that 
includes: 


BR Court order requires logging for auditing purposes: {f} - Query request 
o 1 e User login 
Query requests } œ Internet protocol address 
e User login : | œ Date and time of the access 
e|P address | 


e Date and time of the access 


fe X oi 


ng, Sharing, Dissemination, and Retention L5S4 


{TCHCOLUAICY 


CFSHSIYNE} Remember only a select 
number of analysts are authorized to 
query the raw metadata. 


(FSYSW/NE\ When distributing BR 3 Le uf 
FISA query results the distributions are 4 
categorized as thosetinternal to NSA eee 
which will be called ‘Sharing’ and ae 


those outside of NSA which willbe feta nati’ 
called ‘Dissemination’. 


CFSHSIHNF} It is the BR FISA Query 
Analyst’s responsibility to ensure that 
the recipient of the query results is 
approved to receive BR derived 
information. 


itis the BR FISA Query Analyst's responsibility to ensure that the recipient of the query 
results is approved to receive BR derived information. 


& 
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-Lesson 5: Accessing, Sharing, Dissemination, and Retention LSS. 
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(U//F6¥€) Before we discuss 
distribution, it is important to define 
query results. So, what are query 
results? 


LTALIA 


(TSHSTHINE?A “query result” is a piece 
of information that would not have 
been known, or a statement of fact or 
opinion that would not have been 
made, but for information revealed 
following a BR or Pen Register and 


Trap and Trace (PR/TT) query usinga 
RAS (Reasonable Articulable 
Suspicion) -approved selector. 


This definition includes information 
in the form in which it appears 
immediately followir 

PR/TT query, @.9., 

well as information Meet 

changed form, e.g., a statement 
describing certain links in a 
contact chain. Summaries derived 
from BR chaining are also query 
results. 


This definition makes no 
distinction between minimized and 
unminimized information. 


a Lesson.5: Accessing, Sharing, Dissemination, and Retention. L556 


| -FSHSHNE Sharing of BR FISA query 


results can take place formally or 
informally and may take place orally or in 
writing, Sharing can even include a phone 
call. 


H -CFSHSHNE} So, when do the restrictions 
IS on the sharing of query results cease to 
S| apply? 


ak -FSHSHNE The term “query result” does 


not govern properly disseminated SIGINT 
products containing information derived 
from authorized queries of the BR or 
PR/TT metadata. 


Sharing Procedures 


—CFSHSHANS-The term “query result” does 
aa wtp F not extend to identifiers discovered as a 


| F result of authorized queries of the BR or 
PR/TT metadata, to the extent those 
identifiers are used for tasking purposes 
elsewhere. E.g., a foreign identifier 
discovered as a result of an authorized BR 
query may be tasked in] à land 
neither the tasking information contained in 
DH) Brox the collection that results 
would continue to require the sharing 
restrictions applicable to BR query results. 


fi Pee FNY ap ARES ie 
Lesson 5: Accessing, Sharing, Dissemination, and Retention L5s 


r rai ei 


You are responsible for following current Order’s rules when sharing 
BR FISA query results 


({TOHOLURICYS 


~G N= The person who is 


sharing a query result is responsible 
for ensuring that the recipient is 
authorized to receive it. To see your 
current responsibility please refer to 
the job-aid entitled BR FISA Query 
Analyst Responsibilities. 


(FSHSIANF) Individuals who receive 
BR derived information (query results) 
must be briefed by the OGC and have 
current OVSC1800 training. They will 
be authorized by SID Office of 
Oversight and Compliance SV4 to 
receive BR query results. Remember, 
authorization to receive query results 
does not authorize access to BR raw 
metadata. 


X foe 


: Lesson 5: Accessing, Sharing, Dissemination, and Retention L5S8 


If any BR FISA derived metadata is to be shared or 
coordinated beyond the personnel who are approved to 
receive it, contact the Office of Oversight and Compliance or 
the Office of General Counsel BEFORE you share! 


—CFSHSIHNF} If any BR FISA derived 
metadata is to be shared or 
coordinated beyond the personnel who : 
are approved to receive it, contact the 
Office of Oversight and Compliance or 
OGC BEFORE you share! 


(FSHSWNE} The court-ordered 
minimization procedures for BR FISA 
disseminations differ from NSA’s 
standard USSID SP0018 procedures 
in the following key aspects: 


: p F : ia 1. The Chief of S12 (or approved 
+ The Court Ordered procedures for disseminations of E| officials named in the court order) 


or the National Security 


query results apply from USSID SP0018. In addition, #f Operations Center Senior 
i e Ty O ti Offi NSOC SOO è 
there are a couple of unique requirements: Hust approve a 


US person information. (please 
refer to the glossary for a definition 


Chief S12 or the NSOC SOO (or one of the three other of dissemination) 
named positions in the BR FISA Order) must approve EE rst aha pal aoai 


i i ; 1 information must be for a 
the dissemination of US person information 13 counterterrorism purpose and only 
; if necessary to understand or 
assess the counterterrorism 
Any US person information disseminated must be for a pet e a ae 
counterterrorism purpose and necessary to understand individuals who have received 
: : 7 . : query results. 
the counterterrorism information or assess its E eurtnercalltileseminetions must 
imporiance. 1 | be reported in a weekly report to 
; the FISC. 


Geriu 


Retention 


Retention of raw metadata, chai 


Dissemination, and Retention L5S 


summaries, and query results is limi 


ted io 5 years 


i metadata, chain summaries, and 
+ query results is limited to 5 years. 


“4 -—TSHYSI/NE) This applies to all 


repositories holding BR FISA 
metadata. 


Lesson 5: Accessing, Sharing, Dissemination, and Retention L5S1 


ng 


WRT 


You should now be able to: 


e Distinguish between analysts authorized to query 
BR FISA metadata and individuals authorized to 
receive results of those queries 


e Identify further limitations on accessing, sharing, 
disseminating, and retaining BR FISA metadata 


-FSHSHINES You should now be able 
to: 


Distinguish between 
analysts authorized to 
query BR FISA metadata 
and individuals 
authorized to receive 
results of those queries 
Identify further limitations 
on accessing, sharing, 
disseminating, and 
retaining BR FISA 
metadata 


e Where do we go from here?” L59812 


e 


| -FSHSIHNE} If you have not already 
done so, please read the BR Order 
and RAS Memo located in the Legal 
Readings icon. Then proceed to the 
Final Exam to take the test. After you 


Homeland Mission Coordinators: j have completed the test, to gain 
EE to th tadata, SV4 will d 
DL S2141 _HMC (ALIAS) S215 Ft to review and approve your access. 


‘el (U//FOUS) As always, it is important 
Oversight and Compliance: R to remember that your Homeland 


Mission Coordinator, Oversight and 


SV4 DL SV42 |} Compliance, and the Office of General l s 


Counsel are available to answer any 
specific questions you may have 
relating to these authorities. 


General Counsel: yi Remember that this is the BR FISA 


course and does not replace training 
£ J iti 
go gc or | on other FISA authorities. 


Here are some contacts: 
Homeland Mission Coordinators: 
DL $2I41_HMC (ALIAS) S215 
Oversight and Compliance: 
SV4 DL_SV42 
General Counsel: 

‘go gc’ or 


